-1

Possible Duplicate:
My server's been hacked EMERGENCY

I installed Debian (Squeeze) a while back in my home network to host some personal sites (thank god).

During the installation it prompted me to enter a user other than root - so in a rush I used my name as user and pass (alex/alex for what its worth).

I know it's horrible practice but during the setup of this server I'm always logged in as root to perform configurations, etc.

Few days or a week passes and I forget to change the password. Then I finally get my web site finished and I open the port forwarding on my router and DynDNS to point to my server in my home. I've done this many times in the past never had issues but I use a cryptic root password and I guess disabled regular accounts.

Today I reformat my Windows 7 and after spending all day tweaking and updating SP1 I look for cloning apps and find clonezilla and see it supports SSH cloning, so I go through the process only to discover I need a user, so I log into my web-server and see I have the user 'alex' already in and realize I don't know the password. So I change the password to something cryptic and visit the directory 'home' only to realize their are contents such as passfile, bengos, etc. My heart sinks, I've been hacked!!! Sure as hell there are all sort of scripts and password files.

I run a 'last' command and it seems they last logged in april 3rd.

Question:

  1. What can I do to see if they did anything destructive? Should I reformat and reinstall?
  2. How restrictive is Debian/Squeeze in terms of user permissions out of the box - all my personal website stuff was created using 'root' so changing files does not seem to have occured.
  3. How did they determine there was a user 'alex' on the machine? Can you query any machine and figure this out? What the users are? Looks like they tried to run a IP scan...other nodes on the network are running Windows 7. One of which seems a little wonky as of late - is it possible they buggered up that system?

What corrective action can I take to avoid this from happening again? And figure out what might have changed or been hacked? I'm hoping debian out of box is fairly secure and at best he managed to read some of my source code. :p

Regards, Alex

1
  • 1
    1.) Yes, format/reinstall - see this related question. 2.) If the box was compromised, you have no guarantee they didn't also get root. Your permission settings were of no consequence. 3.) Google "Brute Force".
    – jscott
    Apr 15, 2012 at 2:53

2 Answers 2

5

↓ Click the Pretty Cloud! ↓

Nuke it from orbit!

↑ You'll Like It!! ↑

3
  • 1
    You like using that graphic, don't you? :)
    – EEAA
    Apr 15, 2012 at 3:33
  • @ErikA Look into the light! It's so beautiful!
    – Wesley
    Apr 15, 2012 at 3:35
  • But won't the UV rays burn my retinas?
    – EEAA
    Apr 15, 2012 at 3:35
1

What can I do to see if they did anything destructive?

It's probably not worth the time. There are a million things they could have done.

Should I reformat and reinstall?

Absolutely yes.

How did they determine there was a user 'alex' on the machine? Can you query any machine and figure this out? What the users are?

It's called a bruteforce attack. They automatically tried steve/steve, jack/jack, and admin/password too. Just so happened they found your really bad password.

How restrictive is Debian/Squeeze in terms of user permissions out of the box - all my personal website stuff was created using 'root' so changing files does not seem to have occured ... is it possible they buggered up that system?

Yes. They would have needed to use a system vulnerability in order to change any "root-only" files, so it's possible that they didn't. But you should not take the risk. Reformat, reinstall, and restore backups. If you don't have backups you'll need to carefully inspect all your data to make sure it wasn't modified; not a very easy or quick task. Debian squeeze is decent out-of-the-box in my humble opinion - just not if you use a terrible password.

What corrective action can I take to avoid this from happening again?

Simply use a better password. Even better, move ssh to a non-standard port and switch to using ssh keys (forbid remote password logins and remote root logins). Here's some more advice: http://isc.sans.edu/diary.html?storyid=4408

1
  • Thanks very much :) I basically needed to hear some common sense to reconfirm my own actions in reformatting. I have scouring over log files for hours now and it would seem they somehow logged in as a user. I can't say exactly what the regular account password was but I wouldn't be surprised if it were alex (set at install and forgot about). I will def. take this as a learning experience and will be brushing up on security. Thanks again everyone. Apr 15, 2012 at 7:21

Not the answer you're looking for? Browse other questions tagged .